Vulnerability attack sample characterization method, device, storage medium and electronic device

Abstract

The present application provides a vulnerability attack sample characterization method, device, storage medium and electronic device, the method comprising: obtaining each vulnerability attack sample to be characterized; deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample, the sample information comprising at least one vulnerability attack component, attribute annotation of each vulnerability attack component, vulnerability attack primitive of each vulnerability attack component and attribute annotation of each vulnerability attack primitive; generating knowledge items of each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample; generating vulnerability attack family tree based on the knowledge items of each vulnerability attack sample. The generalization ability of vulnerability attack sample characterization can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability attack sample characterization method, device, storage medium and electronic device. Background Art

[0002] In today's era of rapid development of artificial intelligence technology, data has become a core element to drive innovation and solve complex problems. The performance and accuracy of artificial intelligence systems are highly dependent on the quality and representation of the data they process. Data representation, as a key technical means, aims to transform originally unstructured information that is difficult for computers to directly interpret into a structured form of knowledge that computers can efficiently process and understand. This process is crucial to building high-performance and highly adaptable artificial intelligence systems. It is directly related to whether the system can extract valuable information from massive data and make accurate decisions.

[0003] Especially in the field of network security, vulnerability attack samples, as a special and important data resource, play an irreplaceable role in analyzing attack behaviors and improving the effectiveness of defense strategies. Accurate and efficient characterization of vulnerability attack samples can help security researchers quickly identify potential threats and develop targeted protection measures, thereby effectively reducing the losses caused by network attacks. However, current methods for characterizing vulnerability attack samples face significant challenges.

[0004] Traditionally, vulnerability attack samples are characterized using fixed patterns or deterministic rules, which focus on ensuring the executability of samples and the directness of analysis. Although this approach improves the efficiency of analysis to a certain extent, over-reliance on fixed patterns often limits the generalization ability of the characterization method, making it ineffective when facing new or variant attacks and difficult to adapt to the ever-changing network threat environment. Summary of the invention

[0005] The technical problem to be solved by this application is to provide a vulnerability attack sample characterization method, device, storage medium and electronic device, which can improve the generalization ability of vulnerability attack sample characterization. The specific solution is as follows:

[0006] A vulnerability attack sample characterization method, comprising:

[0007] Obtain attack samples of various vulnerabilities to be characterized;

[0008] Deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute label of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute label of each vulnerability attack primitive;

[0009] Generate a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample;

[0010] A vulnerability attack family tree is generated based on the knowledge entries of each vulnerability attack sample.

[0011] In the above method, optionally, deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample includes:

[0012] Functionally dividing each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, and obtaining at least one vulnerability attack component of each vulnerability attack sample;

[0013] Performing minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component;

[0014] According to the vulnerability description information of each vulnerability attack sample, attribute annotation is performed on the vulnerability attack component of each vulnerability attack sample and the vulnerability attack primitive of each vulnerability attack component to obtain sample information of each vulnerability attack sample.

[0015] In the above method, optionally, generating a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample includes:

[0016] For each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, the sample information of the vulnerability attack sample is processed using a context-free grammar to obtain knowledge entries of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, the sample information of the vulnerability attack sample is processed using a context-dependent grammar to obtain knowledge entries of the vulnerability attack sample.

[0017] In the above method, optionally, generating a vulnerability attack family tree based on knowledge items of each vulnerability attack sample includes:

[0018] Determining a vulnerability exploitation mode of each vulnerability attack sample according to the sample type and knowledge items of each vulnerability attack sample;

[0019] The knowledge items of each Web-type vulnerability attack sample and the vulnerability exploitation pattern are used to construct a merged syntax tree to obtain the Web-type vulnerability attack family tree;

[0020] A knowledge graph is constructed using the knowledge entries of various memory corruption vulnerability attack samples and vulnerability exploitation patterns to obtain the memory corruption vulnerability attack family tree.

[0021] The above method may optionally further include, after generating a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample:

[0022] Output the vulnerability attack family tree.

[0023] A vulnerability attack sample characterization device, comprising:

[0024] An acquisition unit, used to acquire each vulnerability attack sample to be characterized;

[0025] A deconstruction unit, configured to deconstruct each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute annotation of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute annotation of each vulnerability attack primitive;

[0026] A first generating unit, configured to generate a knowledge entry for each vulnerability attack sample according to a sample type and sample information of each vulnerability attack sample;

[0027] The second generating unit is used to generate a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample.

[0028] In the above device, optionally, the deconstruction unit comprises:

[0029] A first division subunit is used to perform functional division on each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, and obtain at least one vulnerability attack component of each vulnerability attack sample;

[0030] A second division subunit is used to perform minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component;

[0031] The labeling subunit is used to label the vulnerability attack components of each vulnerability attack sample and the vulnerability attack primitives of each vulnerability attack component according to the vulnerability description information of each vulnerability attack sample, so as to obtain the sample information of each vulnerability attack sample.

[0032] In the above device, optionally, the first generating unit includes:

[0033] The first execution sub-unit is used for, for each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, processing the sample information of the vulnerability attack sample using a context-free grammar to obtain the knowledge entry of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, processing the sample information of the vulnerability attack sample using a context-dependent grammar to obtain the knowledge entry of the vulnerability attack sample.

[0034] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the vulnerability attack sample characterization method as described above.

[0035] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the vulnerability attack sample characterization method as described above.

[0036] The present application provides a vulnerability attack sample characterization method, device, storage medium and electronic device, the method comprising: obtaining each vulnerability attack sample to be characterized; deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample, the sample information comprising at least one vulnerability attack component, attribute annotation of each vulnerability attack component, vulnerability attack primitive of each vulnerability attack component and attribute annotation of each vulnerability attack primitive; generating knowledge entries of each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample; generating vulnerability attack family tree based on the knowledge entries of each vulnerability attack sample. Applying the method provided in the embodiment of the present application can improve the generalization ability of vulnerability attack sample characterization. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0038] Figure 1 A method flow chart of a vulnerability attack sample characterization method provided in this application;

[0039] Figure 2 A flowchart of a process for obtaining sample information of each vulnerability attack sample provided by the present application;

[0040] Figure 3A flowchart of a process for generating a vulnerability attack family tree based on knowledge entries of each vulnerability attack sample provided by the present application;

[0041] Figure 4 An example diagram for constructing a Boolean SQL injection vulnerability attack family tree provided for this application;

[0042] Figure 5a Construct an example diagram for the component part of a vulnerability attack family tree provided by this application;

[0043] Figure 5b Construct an example graph for the primitive portion of a vulnerability attack family tree provided by this application;

[0044] Figure 6 A schematic diagram of the structure of a vulnerability attack sample characterization device provided in this application;

[0045] Figure 7 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0048] The embodiment of the present application provides a vulnerability attack sample characterization method, which can be applied to electronic devices, and the electronic devices can be smart phones, tablet devices, smart wearable devices, etc. The method flow chart of the method is as follows Figure 1 As shown, specifically including:

[0049] S101: Obtain each vulnerability attack sample to be characterized.

[0050] S102: Deconstruct each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, attribute annotation of each vulnerability attack component, vulnerability attack primitive of each vulnerability attack component, and attribute annotation of each vulnerability attack primitive.

[0051] In this embodiment, the vulnerability attack sample can be divided into several vulnerability attack components according to the functions in the vulnerability attack process; then, the vulnerability attack component can be divided into one or more vulnerability attack primitives according to the minimum semantic logic function. Finally, the vulnerability attack component and the vulnerability attack primitive are attributed according to the vulnerability attack description, so as to obtain the sample information of the vulnerability attack sample.

[0052] In an embodiment provided in the present application, based on the above implementation process, optionally, the process of deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample is as follows: Figure 2 As shown, including:

[0053] S201: Functionally divide each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, and obtain at least one vulnerability attack component of each vulnerability attack sample.

[0054] In this embodiment, according to the function in the vulnerability attack process, multiple first character patterns (Web type vulnerabilities) and first byte patterns (memory corruption type vulnerabilities) are predefined, and each first character pattern and first byte pattern corresponds to a vulnerability attack component. The vulnerability attack sample is matched with each first character pattern and first byte pattern using a pattern matching method to determine the pattern that successfully matches the vulnerability attack sample. Then, the vulnerability attack component corresponding to the pattern that successfully matches the vulnerability attack sample is used as the vulnerability attack component of the vulnerability attack sample.

[0055] Optionally, functions during the vulnerability attack process include leaking memory addresses, hijacking stack pointers, jumping control flow to specified locations, disabling stack protection, and filling with empty instructions.

[0056] S202: Performing minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component.

[0057] In this embodiment, based on the minimum semantic logical function, some second character patterns (Web type vulnerabilities) and second byte patterns (memory corruption type vulnerabilities) are predefined, each second character pattern and each second byte pattern corresponds to a vulnerability attack primitive, and the vulnerability attack component is matched with each second character pattern and second byte pattern using a pattern matching method, and the vulnerability attack primitive corresponding to the pattern that successfully matches the vulnerability attack component is determined as the vulnerability attack primitive of the vulnerability attack component.

[0058] In this embodiment, the minimum semantic logic functions include atomic operations such as writing controllable values ​​to fixed memory locations, writing fixed values ​​to controllable memory locations, reading memory values ​​from controllable memory locations, writing controllable values ​​to registers, modifying registers to fixed values, allocating controllable size memory space, and executing specific system functions.

[0059] S203: According to the vulnerability description information of each vulnerability attack sample, attribute annotation is performed on the vulnerability attack component of each vulnerability attack sample and the vulnerability attack primitive of each vulnerability attack component to obtain sample information of each vulnerability attack sample.

[0060] In this embodiment, based on named entity recognition technology, at least one of the attributes such as vulnerability attack components, primitive names, components, primitive values, value types, functions, pre-execution conditions, post-execution effects, and execution environments can be identified in the vulnerability attack description, and the attributes can be extracted and annotated in the vulnerability attack components and primitives.

[0061] S103: Generate a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample.

[0062] In this embodiment, the sample type may include at least one of a Web type and a memory corruption type.

[0063] In an embodiment provided by the present application, based on the above implementation process, optionally, the process of generating a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample includes:

[0064] For each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, the sample information of the vulnerability attack sample is processed using a context-free grammar to obtain knowledge entries of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, the sample information of the vulnerability attack sample is processed using a context-dependent grammar to obtain knowledge entries of the vulnerability attack sample.

[0065] In this embodiment, knowledge is expressed in Backus-Naur Normal Form (BNF) for describing context-free grammar for Web-type vulnerability attack samples and the vulnerability attack components and primitives deconstructed therefrom, thereby forming vulnerability attack knowledge entries.

[0066] In this embodiment, the memory corruption vulnerability attack samples and the vulnerability attack components and primitives deconstructed from them are expressed in Kuroda Normal Form (KNF) for describing context-dependent grammars to form vulnerability attack knowledge items.

[0067] S104: Generate a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample.

[0068] In this embodiment, the vulnerability attack family tree may include a Web-type vulnerability attack family tree in the form of a Web-type merged syntax tree, and a memory-corruption-type vulnerability attack family tree in the form of a memory-corruption-type knowledge graph.

[0069] In an embodiment provided by the present application, based on the above implementation process, optionally, the process of generating a vulnerability attack family tree based on the knowledge entries of each vulnerability attack sample is as follows: Figure 3 As shown, including:

[0070] S301: Determine the vulnerability exploitation mode of each vulnerability attack sample according to the sample type and knowledge items of each vulnerability attack sample; the sample types include Web type and memory destruction type.

[0071] In this embodiment, a large number of Web vulnerability attack samples and vulnerability attack knowledge items are analyzed to summarize Web vulnerability exploitation patterns (such as Boolean SQL injection, stacked SQL injection, etc.).

[0072] In the embodiment, memory corruption vulnerability exploitation patterns (ret2shellcode, ret2libc, Off-by-One, etc.) are summarized by analyzing a large number of memory corruption vulnerability attack samples and vulnerability attack knowledge items.

[0073] S302: construct a merged syntax tree using knowledge items of each Web-type vulnerability attack sample and vulnerability exploitation pattern to obtain a Web-type vulnerability attack family tree.

[0074] In this embodiment, for Web-type vulnerability attacks, knowledge items under the same vulnerability exploitation mode are merged to construct a merged syntax tree containing vulnerability attack components, primitives, and intermediate nodes. The depth-first search algorithm is applied to add each node reflected in the knowledge item to the merged syntax tree from bottom to top, and then the nodes with common syntax are merged, and gradually abstracted upward into a vulnerability attack family tree described in the form of a vulnerability attack merged syntax tree.

[0075] S303: Construct a knowledge graph using knowledge items of each memory corruption vulnerability attack sample and vulnerability exploitation pattern to obtain a family tree of memory corruption vulnerability attacks.

[0076] In this embodiment, for memory corruption vulnerability attacks, knowledge items under the same vulnerability exploitation mode are merged to construct component-level knowledge graphs and primitive-level knowledge graphs. The depth-first search algorithm is applied to add each component or primitive reflected in the knowledge item to the component-level and primitive-level knowledge graphs from bottom to top, and then the nodes with common syntax are merged, and gradually abstracted upward into a vulnerability attack family tree described in the form of a vulnerability attack knowledge graph.

[0077] By applying the method provided in the embodiments of the present application, the generalization capability of vulnerability attack sample representation can be improved.

[0078] In an embodiment provided by the present application, based on the above implementation process, optionally, after generating a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample, the process further includes:

[0079] Output the vulnerability attack family tree.

[0080] In order to clearly illustrate the specific implementation process and principle of the vulnerability attack sample characterization method, the following example is given:

[0081] Step 1: Obtain samples of vulnerability attacks to be characterized.

[0082] Step 2: Deconstruct the vulnerability attack sample. In this embodiment, the vulnerability attack component division can be based on pattern matching. Specifically, the vulnerability attack component division can be performed based on pattern matching: character patterns of Web-type vulnerability attacks (such as comments--.*, statement separators {)|;|…}, etc.) and byte patterns of memory corruption-type vulnerability attacks (such as null bytes 0x90+, protocol headers 0xDEA498…, etc.) are defined respectively, and the given vulnerability attack sample is divided into components / primitives using the pattern matching method. In particular, for complex vulnerability attack samples, the vulnerability attack components can be obtained by manual division. Then the vulnerability attack primitives are divided based on pattern matching. Finally, the vulnerability attack component / primitive attribute annotation based on named entity recognition. Specifically, the corresponding attributes can be extracted from the vulnerability attack description based on named entity recognition: based on the vulnerability attack description, the named entity recognition (NER) model is trained to identify the attributes of the components or primitives in the vulnerability attack description according to the protocol specification, the semantics of the vulnerability exploitation function, etc.

[0083] As shown in Table 1, after deconstructing the CVE-2021-35042 vulnerability attack sample, the corresponding Web-type vulnerability attack component can be obtained;

[0084] Table 1

[0085]

[0086] As shown in Table 2, after deconstructing the CVE-2017-9430 vulnerability attack sample, the corresponding memory corruption vulnerability attack component can be obtained.

[0087] Table 2

[0088]

[0089] Step 3: Grammar-based vulnerability attack knowledge expression. In this embodiment, based on vulnerability attack samples, components, and primitives, a context-free grammar is used for Web-type vulnerability attack samples, and knowledge is expressed based on the Backus-Naur form; a context-sensitive grammar is used for memory corruption-type vulnerability attack samples, and knowledge is expressed based on the Kuroda form to form vulnerability attack knowledge items.

[0090] In this embodiment, the Web-type vulnerability attack knowledge expression based on the context-free grammar can be used. Specifically, by analyzing the Web-type vulnerability attack components / primitives, it can be found that the contextual relationship between the components / primitives of the Web-type vulnerability attack samples is weak. Therefore, the Backus-Naur form used to describe the context-free grammar is used to express the Web-type vulnerability knowledge to form vulnerability attack knowledge entries.

[0091] For example, the vulnerability attack components / primitives of Boolean SQL injection attacks can be expressed in layers using the Backus-Naur form, and their knowledge items can be expressed as: boolAttack::={'or 1!=2--|'or 1=1#|…};

[0092] ['or 1!=2--] ::= ',or,1!=2,--;

[0093] ['or 1=1#] ::= ',or,1=1,#;

[0094] [1!=2] ::= 1,!=,2;

[0095] [1=1] ::= 1,=,1; …

[0096] In this embodiment, the memory corruption type vulnerability attack knowledge expression based on the context-sensitive grammar can be performed. Specifically, by analyzing the memory corruption type vulnerability attack components / primitives, it can be found that the contextual relationship between the components / primitives of the memory corruption type vulnerability attack samples is strong. Therefore, the Kuroda form used to describe the context-sensitive grammar is used to express the memory corruption type vulnerability attack knowledge to form vulnerability attack knowledge entries.

[0097] For example, the vulnerability attack knowledge entry for CVE-2017-9430 can be expressed as:

[0098] CVE-2017-9430_ATTACK::=Fixed padding, EIP springboard, (no stack protection, no ASLR) Shellcode or Fixed padding, EIP springboard, Nop padding, (no stack protection, no ASLR) Shellcode

[0099] EIP springboard::={jmp ESP}, Shellcode::={rebound Shell...}…

[0100] Step 4: Construction of vulnerability attack family tree based on knowledge merging. In the embodiment, vulnerability attack knowledge items can be analyzed to summarize different vulnerability exploitation patterns; then, based on the co-occurrence pattern and internal hierarchical logic presented by the knowledge items under each vulnerability exploitation pattern, a depth-first search algorithm is applied to merge semantically common nodes from bottom to top to form a vulnerability attack family tree, based on which the vulnerability exploitation pattern can be formally represented.

[0101] In this embodiment, a Web-type vulnerability attack family tree can be constructed based on tree merging. Specifically, for Web-type vulnerability attacks, knowledge items under the same vulnerability exploitation mode are merged to construct a merged syntax tree containing vulnerability attack components, primitives, and intermediate nodes. The depth-first search algorithm is applied to add each node reflected in the knowledge item to the merged syntax tree from the bottom up, and then the nodes with common syntax are merged, and gradually abstracted upward into a vulnerability attack family tree described in the form of a vulnerability attack merged syntax tree. Figure 4 As shown in the figure, it is an example diagram of constructing a Boolean SQL injection vulnerability attack family tree, which merges the common components, primitives, and intermediate nodes in two Boolean SQL injection vulnerability attack knowledge items to construct a Boolean SQL injection vulnerability attack family tree. At the same time, the vulnerability exploitation pattern of Boolean SQL injection can be formally expressed as: Boolean SQL injection attack vulnerability exploitation pattern::=' or [True] [comment delimiter].

[0102] In this embodiment, a family tree of memory corruption vulnerability attacks can be constructed based on graph merging. Specifically, for memory corruption vulnerability attacks, knowledge items under the same vulnerability exploitation mode are merged to construct component-level knowledge graphs and primitive-level knowledge graphs. The depth-first search algorithm is applied to add each component or primitive reflected in the knowledge item to the component-level and primitive-level knowledge graphs from the bottom up, and then the nodes with common syntax are merged, and gradually abstracted upward into a vulnerability attack family tree described in the form of a vulnerability attack knowledge graph. Figure 5a and Figure 5b As shown, Figure 5a An example diagram showing the component part of the Off-by-one vulnerability attack family tree. Figure 5b The example of the primitive part construction process of the Off-by-one vulnerability attack family tree is shown. By merging the common components or primitives in two Off-by-one vulnerability attack knowledge entries, the component-level knowledge graph and the primitive-level knowledge graph are constructed to form the Off-by-one vulnerability attack family tree. At the same time, the Off-by-one vulnerability exploitation pattern can be formally expressed as:

[0103] Off-by-one vulnerability exploitation mode::=[Off-by-one],*(chunk_A operation),[forged heap block chunk_B],*(obtain controllable heap block),[release forged heap block],*(modify sensitive fields),[hijack control flow].

[0104] and Figure 1 Corresponding to the method, the embodiment of the present application also provides a vulnerability attack sample characterization device for Figure 1 The specific implementation of the method is shown in the following diagram: Figure 6 As shown, including:

[0105] An acquisition unit 601 is used to acquire each vulnerability attack sample to be characterized;

[0106] A deconstruction unit 602 is used to deconstruct each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute label of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute label of each vulnerability attack primitive;

[0107] A first generating unit 603, configured to generate a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample;

[0108] The second generating unit 604 is configured to generate a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample.

[0109] In an embodiment provided in the present application, based on the above solution, optionally, the deconstruction unit includes:

[0110] A first division subunit is used to perform functional division on each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, and obtain at least one vulnerability attack component of each vulnerability attack sample;

[0111] A second division subunit is used to perform minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component;

[0112] The labeling subunit is used to label the vulnerability attack components of each vulnerability attack sample and the vulnerability attack primitives of each vulnerability attack component according to the vulnerability description information of each vulnerability attack sample, so as to obtain the sample information of each vulnerability attack sample.

[0113] In an embodiment provided in the present application, based on the above solution, optionally, the first generating unit includes:

[0114] The first execution sub-unit is used for, for each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, processing the sample information of the vulnerability attack sample using a context-free grammar to obtain the knowledge entry of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, processing the sample information of the vulnerability attack sample using a context-dependent grammar to obtain the knowledge entry of the vulnerability attack sample.

[0115] In an embodiment provided in the present application, based on the above solution, optionally, the second generating unit includes:

[0116] A determination subunit, configured to determine a vulnerability exploitation mode of each vulnerability attack sample according to a sample type and a knowledge item of each vulnerability attack sample;

[0117] The first construction subunit is used to construct a merged syntax tree using knowledge items of each Web-type vulnerability attack sample and vulnerability exploitation pattern to obtain a Web-type vulnerability attack family tree;

[0118] The second construction sub-unit is used to construct a knowledge graph using knowledge items of various memory corruption vulnerability attack samples and vulnerability exploitation patterns to obtain a family tree of memory corruption vulnerability attacks.

[0119] In an embodiment provided in the present application, based on the above solution, optionally, the vulnerability attack sample characterization device further includes:

[0120] The output unit is used to output the vulnerability attack family tree.

[0121] The specific principles and execution processes of each unit and module in the vulnerability attack sample characterization device disclosed in the above-mentioned embodiment of the present application are the same as the vulnerability attack sample characterization method disclosed in the above-mentioned embodiment of the present application. Please refer to the corresponding parts of the vulnerability attack sample characterization method provided in the above-mentioned embodiment of the present application, and will not be repeated here.

[0122] An embodiment of the present application further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned vulnerability attack sample characterization method.

[0123] The present application also provides an electronic device, whose structural diagram is as follows: Figure 7 As shown, it specifically includes a memory 701 and one or more instructions 702, wherein the one or more instructions 702 are stored in the memory 701 and are configured to be executed by one or more processors 703 to perform the following operations:

[0124] Obtain attack samples of various vulnerabilities to be characterized;

[0125] Deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute label of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute label of each vulnerability attack primitive;

[0126] Generate a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample;

[0127] A vulnerability attack family tree is generated based on the knowledge entries of each vulnerability attack sample.

[0128] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0129] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0130] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0131] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0132] The above is a detailed introduction to a vulnerability attack sample characterization method provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A vulnerability attack sample characterization method, characterized in that: include: Obtain attack samples of various vulnerabilities to be characterized; Deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute label of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute label of each vulnerability attack primitive; Generate a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample; Generate a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample; Deconstructing each vulnerability attack sample to obtain sample information of each vulnerability attack sample includes: Functionally dividing each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, and obtaining at least one vulnerability attack component of each vulnerability attack sample; Performing minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component; According to the vulnerability description information of each vulnerability attack sample, attribute annotation is performed on the vulnerability attack component of each vulnerability attack sample and the vulnerability attack primitive of each vulnerability attack component to obtain sample information of each vulnerability attack sample.

2. The method according to claim 1, characterized in that Generating a knowledge entry for each vulnerability attack sample according to the sample type and sample information of each vulnerability attack sample includes: For each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, the sample information of the vulnerability attack sample is processed using a context-free grammar to obtain knowledge entries of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, the sample information of the vulnerability attack sample is processed using a context-dependent grammar to obtain knowledge entries of the vulnerability attack sample.

3. The method according to claim 1, characterized in that The generating of the vulnerability attack family tree based on the knowledge items of each vulnerability attack sample comprises: Determine the vulnerability exploitation mode of each vulnerability attack sample according to the sample type and knowledge items of each vulnerability attack sample, wherein the sample type includes a Web type and a memory destruction type; The knowledge items of each Web-type vulnerability attack sample and the vulnerability exploitation pattern are used to construct a merged syntax tree to obtain the Web-type vulnerability attack family tree; A knowledge graph is constructed using the knowledge entries of various memory corruption vulnerability attack samples and vulnerability exploitation patterns to obtain the memory corruption vulnerability attack family tree.

4. The method according to claim 1, characterized in that: After generating the vulnerability attack family tree based on the knowledge items of each vulnerability attack sample, the method further includes: Output the vulnerability attack family tree.

5. A vulnerability attack sample characterization device, characterized in that: include: An acquisition unit, used for acquiring each vulnerability attack sample to be characterized; A deconstruction unit, configured to deconstruct each vulnerability attack sample to obtain sample information of each vulnerability attack sample, wherein the sample information includes at least one vulnerability attack component, an attribute annotation of each vulnerability attack component, a vulnerability attack primitive of each vulnerability attack component, and an attribute annotation of each vulnerability attack primitive; A first generating unit, configured to generate a knowledge entry for each vulnerability attack sample according to a sample type and sample information of each vulnerability attack sample; A second generating unit, configured to generate a vulnerability attack family tree based on the knowledge items of each vulnerability attack sample; The deconstruction unit comprises: A first division subunit is used to perform functional division on each vulnerability attack sample according to the function of each vulnerability attack sample in the vulnerability attack process, so as to obtain at least one vulnerability attack component of each vulnerability attack sample; A second division subunit is used to perform minimum semantic logical function division on each vulnerability attack component to obtain at least one vulnerability attack primitive of each vulnerability attack component; The labeling subunit is used to label the vulnerability attack components of each vulnerability attack sample and the vulnerability attack primitives of each vulnerability attack component according to the vulnerability description information of each vulnerability attack sample, so as to obtain the sample information of each vulnerability attack sample.

6. The device according to claim 5, characterized in that The first generating unit comprises: The first execution sub-unit is used for, for each of the vulnerability attack samples, when the sample type of the vulnerability attack sample is a Web type, processing the sample information of the vulnerability attack sample using a context-free grammar to obtain the knowledge entry of the vulnerability attack sample; when the sample type of the vulnerability attack sample is a memory corruption type, processing the sample information of the vulnerability attack sample using a context-dependent grammar to obtain the knowledge entry of the vulnerability attack sample.

7. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the vulnerability attack sample characterization method according to any one of claims 1 to 4.

8. An electronic device, characterized in that: It includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the vulnerability attack sample characterization method as described in any one of claims 1 to 4.

Images